Two stored cross-site scripting flaws in LiteSpeed Cache were published on 23 October 2026 and fixed in version 7.9.2. The plugin has seven million active installs, and neither flaw needs an account on the site to plant the payload.

What happened

Both bugs sit in the plugin's HTML rewriting routines. One handles font display optimisation and the other rewrites inline CSS for the CDN. In each case the routine is not limited to stylesheet content: it strips a quote or other markup that closes an attribute in the rendered page. When the plugin also outputs a comment author without escaping it, an attacker who gets a comment published can close the attribute and add an event handler. The injected JavaScript then runs in the browser of anyone viewing a front-end page, including a logged-in administrator, while the affected option is enabled.

The two records are CVE-2026-113500 and CVE-2026-113499, both rated 7.2 and both fixed in 7.9.2. No exploitation has been reported against either flaw.

Who is affected

Any WordPress installation running LiteSpeed Cache below 7.9.2.

• Sites on 7.9.1 or older, including the 7.9 branch that was current before this release.
• Sites that accept comments from visitors and publish them, since the payload has to survive comment moderation.
• Sites with font display optimisation or CDN inline CSS rewriting switched on, which is the default posture for most performance-tuned installs.

What to do now

Update LiteSpeed Cache to 7.9.2 and confirm the version number on the plugins page, not just that an update was offered.

• Update the plugin, then purge the cache so the cached copies of affected pages are rebuilt.
• Audit comments approved in the last few weeks for odd author names containing quotes, angle brackets or on-event text.
• Force a password reset and check active sessions for administrator accounts on sites that published such comments.
• Set new comments to require moderation, or disable the two optimisation options until you have updated every site you manage.
• Check the other LiteSpeed Cache advisories published the same day, since 7.9.2 also fixes a missing authorisation issue and a reflected XSS.

What this means for South African businesses

A caching plugin is the kind of component that gets installed once during a speed project and then never looked at again, which is exactly why flaws in it stay live for years. The practical risk for an SME is not the defacement of a brochure page: an XSS payload running in an administrator's session can create a new admin user or install a plugin, which turns a marketing site into a foothold inside the hosting account. If your sites sit on shared hosting alongside email or DNS control panels, treat this as a credential-theft risk rather than a cosmetic one.

Primary source: WPScan advisory for CVE-2026-113500.